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A Resilient Quantum Secret Sharing Scheme 
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Abstract A resilient secret sharing scheme is supposed to generate the secret 
correctly even after some shares are damaged. In this paper, we show how quantum 
error correcting codes can be exploited to design a resilient quantum secret sharing 
scheme, where a quantum state is shared among more than one parties. 
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1 Introduction 

The quantum teleportation of a single qubit was first proposed by Bennett et 
al. [2], using a maximally entangled bipartite quantum state. The idea of telepor¬ 
tation has been successfully applied in the process of quantum secret sharing. In 
quantum teleportation, Alice sends a qubit to a distant receiver Bob through some 
unitary operation involving the qubit and the entangled channel shared between 
them. Further results related to quantum teleportation, that can be exploited in 
quantum secret sharing, include results using multipartite quantum channels such 
as tripartite GHZ state [8] , four-partite GHZ state [16], an asymmetric W state [T| 
and the cluster state [3] . The perfect teleportation of an arbitrary two-qubit state 
was proposed using quantum channels formed by the tensor product of two Bell 
states [19j . tensor product of two orthogonal states [22], genuinely entangled five 
qubit state m , five qubit cluster state in and six qubit genuinely entangled 

states m- 
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Fig. 1 Circuit diagram for 3 qubit phase flip repetition code 


The idea of Quantum Secret Sharing (QSS) of a single qubit was first due 
to Hilery et al. [7] using three and four qubit GHZ states. Later this process 
was investigated by Karlsson et al. [9j using three particle entanglement, Cleve et 
al. [3] using a process similar to error correction and Zheng using W state [26]. The 
QSS of an arbitrary two-qubit state was proposed by Deng et al. using two GHZ 
states QSS using cluster states was demonstrated by Nie m , Panigrahi El 
fT3] and Han [6[. Recently two qubit QSS was discussed using arbitrary pure or 
mixed resource states [25] and asymmetric multipartite state [23]. 

In this paper we do not exploit the ideas related to teleportation in quantum se¬ 
cret sharing. The idea of teleportation does not naturally take care of the situation 
when some adversarial model is considered where some shares may be disturbed. 
Rather, we use quantum error correcting codes to take care of the situation. There 
exist some works )18ll23| for building quantum secret sharing schemes using (classi¬ 
cal or quantum) error correcting codes. However, none of these schemes addresses 
the resiliency issue. 

An arbitrary pure single-qubit quantum state is given by | ip) = a|0) +/3|1) 
with |a| 2 + |/?| 2 = 1, where a, /3 £ C. In quantum error correction scheme known as 
repetition code E, the above state is encoded as a 1000) + /3 1111). This encoding 
can correct a single bit-flip error. In [20], the authors pointed out that any mea¬ 
surement in the computational basis states |0), |1) causes a projection onto the a z 
axis of the Bloch sphere and can be interpreted as an incoherent phase flip. Hence, 
any protocol correcting against phase flips is sufficient to reverse measurements in 
the computational basis. The repetition code can be modified to protect against 
such phase-flip errors by a simple basis change from |0), |1) to |±) = -d=(|0) ± |1)). 

The schematic diagram for undoing a quantum measurement is given in Fig¬ 
ured This idea [20] motivated us to devise a novel quantum secret sharing protocol 
based on quantum error correcting codes. It is resilient in the sense that it survives 
when the line of Bob or Charlie or both is compromised. 


1.1 Our contribution 

In light of the above discussion, let us now explain our exact proposal and its 
importance. In line of Figure [T] we also like to refer to Figure [2] At the bottom 
of the figure, \ipi) below each column denotes the joint 3-qubit state immediately 
after the application of the gates in that column. For example, |^ 3 ) is the state 
after the application of three Hadamard gates in the right half of the diagram. 

The single qubit state |i/>), as in Figure [2] is to be distributed between three 
parties Alice, Bob and Charlie. Two additional |1) qubits are used by the dis¬ 
tributor for this purpose. Each individual particle of the three qubit state |'03) is 
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Fig. 2 Schematic diagram for our quantum secret sharing scheme 


distributed to Alice, Bob and Charlie. Without loss of generalization, it is consid¬ 
ered that when they come together to generate the secret, then Bob and Charlie 
will co-operate with Alice and the secret will be generated with Alice. The particle 
with Alice corresponding to the three-qubit state l^s) should be same as | ip) for a 
successful execution of the protocol. 

We claim that our model is resilient. We consider that Bob or Charlie may 
cheat. This is pointed out by marking “Eaves” instead in the figure. As an example, 
by cheating, we mean that Bob or Charlie may measure their individual qubits in 
certain basis to gain some information about the secret state \ip). In our protocol, 
Alice can detect cheating with certain probabilities if either Bob or Charlie or 
both Bob and Charlie cheat(s). Further, the cheater will not be able to obtain any 
information about the secret state from the particle associated with him. 

One can consider that parties other than Alice, Bob and Charlie may also be 
interested to gain information about the secret to disturb the protocol. However, it 
is enough to consider that Bob and Charlie themselves may play that adversarial 
role. We consider that Alice will be honest and the secret will be prepared by her 
in cooperation with Bob and Charlie. 

Let us present an example. Consider that the cheating is done by Bob and/or 
Charlie and they measure in (|0), 11)} basis. Alice will not disturb the particle that 
is with her, but in case of cheating, she has to operate a phase gate to get back 
the secret. On the other hand, Alice can always measure the other two particles 
corresponding to Bob and Charlie. Thus, Alice can measure those two qubits in 
{100}, |01), 110) , 111)} basis to obtain relevant information regarding cheating. 

To the best of our knowledge, for quantum secret sharing, there exists no such 
scheme in literature that can decide 

— whether the cheating is done, 

— whether the expected state is generated or not and 

— whether the exact state could be achieved after some transformation. 


2 The Proposed Secret Sharing Protocol 

First, the dealer D encodes the secret using the encoding circuit (left part of 
Figure [2] up to \ip 3 ))- The dealer then distributes all three qubits among the 
participants: Alice, Bob and Charlie. Each of them applies Hadamard gate after 
getting the qubits. Now, one of them, say Alice, decides to generate the secret and 
so the other two delivers their qubits to Alice. 
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Alice applies two CNOT gates (as shown in Fig [2J considering her qubit as 
the control. Next, she applies Toffoli gates considering Bob and Charlie’s bits 
as control. Then she applies Hadamard (H) and phase (Z) gates to generate the 
secret at her end. Alice measures the particles corresponding to Bob and Charlie 
in (|00), 101), 110), |11)} basis. 

— If she gets |11), she decides that no cheating has been done in the process. 

— If she gets |01), she understands that cheating is done by Bob. 

— If she gets 110), she understands that cheating is performed by Charlie. 

— If she gets |00), she knows that both Bob and Charlie have cheated. 

In all three cases related to cheating, she has to apply a phase gate to generate 
the secret. On the other hand we have the following cases related to cheating. 

— If Bob has cheated by measuring in (|0), 11)} basis, then Alice will observe 
either |01) or 111) with probability \ each. 

— If Charlie has cheated by measuring in (|0), 11)} basis, then Alice will observe 
either 110) or 111) with probability ^ each. 

— If both Bob and Charlie have cheated by measuring their particle in (|0), |1)} 
basis individually, then Alice will observe any of 100) , |01), 110) , 111) with prob¬ 
ability \ each. 

Thus, in any case, the secret quantum state will be created perfectly. However, 
Alice will be able to understand whether the cheating has been done with certain 
probabilities. 


2.1 Detailed Calculation 

We show the step-by-step evolution of the joint state as the protocol runs from 
left to right in Figure [2] We can write 

|^o) = (a|0)+j9|l))|l)|l>. 

After the application of the Hadamard gate, the joint state becomes 

|V>i) = ^[a(|0) + |l)) + /3(|0)-|l))]|l)|l). 

After the application of the two CNOT gates, the state becomes 

l^2> = 7= [<* (I 011 ) + I 100 )) + P (I 011 ) - I 100 ))] ■ 

Next, the dealer applies three Hadamard gates, one on each line, yielding the state 

life) = \ [« (1000) - |110) + |011) - |101» + /3 (|100) - |010) - |001) + |111»]. 

( 1 ) 

Now, the dealer distributes this state amongst Alice, Bob and Charlie, one particle 
to each. After getting the qubits, each party applies Hadamard on his/her qubit. 
So the resultant state becomes 

hM = 71 [«(1011) +1100)) + p (1011) -1100))] = hM. 
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After two CNOT gates, the state becomes 


h/> 5 > = [a (|011) + |111)) + /3 (|011) - |111))]. 


Next, after application of the Toffoli gate, the state becomes 


|^) = -^[a(|0) + |l»-|9(|0)-|l))]|l)|l). 


After the last Hadamard gate, it reduces to 

|^ 7 )»(a|0)-/3|l))|l)|l). 
The phase gate in the end converts this state into 


|^8) = (a|0)+/J|l))|l)|l) = b/’o). 

Now Alice measures her ancilla in the (|00), |01), 110), 111)} basis. In case she gets 


111 ), she knows that the secret has been successfully generated. 

3 Resiliency of the scheme and analysis of cheating 

In this section, we analyze what happens when Bob or Charlie or both tries to 
cheat to the corresponding lines. We do not consider any other eavesdropper as 
any cheating by other parties can also be done by Bob and Charlie themselves. 

3.1 When Bob attempts cheating 

As Bob wants to get some information about the secret, the way we consider is 
to measure the qubit just after he receives it. Assuming that he measures in the 
computational basis, he gets | 0 ) with probability \ and | 1 ) with probability 

We have the state ^ 3 ) in hand. Suppose Bob gets |0). From Equation (p~|) . we 
can write the remaining two-qubit state as 



After the measurement by Bob, he again replaces the measured qubit (here |0)). 
Then each of Alice, Bob and Charlie applies Hadamard, and the joint state becomes 


tpt B ° C ) = \ [« (|001) + 1100) + |110) + |011)) +/3 (|001) - |100) - |110) + |011»]. 


Now, Bob and Charlie give their qubits to Alice. Alice applies CONTs considering 
her qubit as control. Then the overall state becomes 


) = \ [« (|001) + |111) + 1101) + |011)) +p (|001) - |111) - 1101) + |011))] 



Next, Alice operates Toffoli considering Bob and Charlie’s qubits as control. Then 
we get 


t Kc ) = l Mlo> + |i» (|oi) + |ii)) +/?(|o) - |i» (|oi) - |ii))] 
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Now, Alice applies Hadamard on the first qubit. Thus, the resultant state becomes 
\^ KC ) = [(a |0) -0\l)) |11> + (a |0> +j9|l» |01)]. 

After Alice applies the last phase gate, the state becomes 

yt KC ) = ^ [(«1°} +/3I 1 )) |11> + («10} - 0 |1}) |01>]. (2) 

Now, Alice measures the particles corresponding to Bob and Charlie in the 
basis (|00), |01), 110), 111)}. In this case, she gets 111) with probability \ and |01) 
with probability In the first case, she gets back the secret, but cannot detect that 
Bob has cheated. In the second case, she discovers that Bob has indeed cheated 
and she can get back the secret by applying one more phase gate to her qubit. 
Similarly, when Bob measures |1), the final state becomes 

V * B[C )= 71 [(a |0) + p |1>} |n> - l°> - 0 I 1 )) I 01 )] ■ ( 3 ) 

As can be seen by comparing Equations Q and @, we get the same result after 
Alice measures the particles corresponding to Bob and Charlie in computational 
basis. 


3.2 When Charlie attempts cheating 

In a similar manner, Charlie measures his qubit just after he receives it. Assuming 
that he measures in the computational basis, he gets |0) with probability \ and 
|1) with probability i. 

Suppose Charlie obtains |0). From Equation (Jl]), we can write the remaining 
two-qubit state as 

V * B ) = 71 [q (|00> " |n)) + p (|10> “ |01))] ' 

Now, each applies Hadamard on the respective input and the joint state becomes 

\tpi BC '°) = \[a (| 100 ) + | 010 ) + | 011 ) + | 101 » - 0 (| 100 ) - | 010 ) - | 011 ) + | 101 ))]. 

Now, Bob and Charlie give their qubits to Alice. Alice applies CONTs considering 
her qubit as control. Then she obtains the overall state as 

\^t BC '°) = \ [a (|1H) + 1010} + |011) + |110» - 0 (|111) - |010) - |011) + |110»]. 

Next, Alice operates Toffoli considering Bob and Charlie’s qubits as control. Then 
we get 

K sc “) = h a (|0) + 11>} (|11> +110>) _ p (|0> ■ |1}) (|11) - • 

Now, Alice applies Hadamard on the first qubit. Thus, the resultant state becomes 

|vv sc °) ~ [(« |0) — 0 |1)) 111) + (cn |0) + 0 |1)) 110)]. 
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After Alice applies the last phase gate, the state becomes 

yt BG '°) = [(a |0> + P |1» |11) + (a |0) — P |1)) 110)] . (4) 

Alice measures the qubits of Bob and Charlie in {|00), |01), 110), 111)} basis. In 
this case, she gets 111) with probability \ and 110) with probability In the first 
case, she gets back the secret, but cannot detect that Charlie tried to cheat. In the 
second case, she knows for certain that Charlie has indeed cheated and she can 
get back the secret simply by applying one more phase gate to her qubit. 
Similarly, when Charlie measures 11), the final state becomes 

| ^t BC[ ) = [(« |0> + P |1)) 111) - (a |0> - P |1» 110)]. (5) 

As can be seen by comparing Equations © and ©, we get the same result. 


3.3 When both Bob and Charlie are Eavesdroppers 


Assume that both Bob and Charlie measure in the computational basis. Suppose, 
Bob gets |0) and Charlie also gets |0). From Equation ©, we can write the re¬ 
maining state as 

|^)=a|0>+/3|l). 

After each applies Hadamard, the joint state becomes 

= 7^= [a (|000) + |001) + |010) + |011) + 1100) + |101) + |110> + |111)) 
+/3 (|000) + |001) + |010) + |011) - |100) - |101) - |110) - |111»]. 


Now, Bob and Charlie give their qubits to Alice. Alice applies CONTs considering 
her qubit as control. It can be easily verified that after this, the overall state 
remains the same, i.e., 

Next, Alice operates Toffoli considering Bob and Charlie’s qubits as control. 
Then we get the resultant state as 


I Tp£ B '° C '°) = 7^= [a (1000) + 1001) + 1010) + |011) + |100) + |101) + |110) + |111)) 

+/3 (| 000 ) + | 001 ) + | 010 ) - | 011 ) - | 100 ) - | 101 ) - | 110 ) + ( 111 ))]. 


Now, Alice applies Hadamard on the first qubit. Thus, the resultant state becomes 

|v>7 ' B '° C '°) = [(« | 0 > - P | 1 )) 111 ) + («|0> + p \ l )) (|00) + |01) + 110))]. 

After Alice applies the last phase gate, the state becomes 

\^ KC '°) = [(a |0} + p |1}) |n) + (a | 0) _£!!)) (|00) + |01) + 110))]. 

Now, Alice measures the qubits of Bob and Charlie in (|00), |01), 110), 111)} ba¬ 
sis. In this case, she gets each basis state with probability \. The cases can be 
summarized as follows. 
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— If she gets 111), she gets back the secret, but cannot detect if anyone tried to 
eavesdrop. 

— If she gets |01), she knows that Bob was eavesdropping. 

— If she gets |10), she knows that Charlie was eavesdropping. 

— If she gets |00), she knows that both Bob and Charlie were eavesdropping. 

By similar analysis of the cases when Bob and Charlie measure the other three 
possible pairs of outputs, we get the same result. 


4 Analysis of Arbitrary Measurements 

The protocol that we discussed can withstand errors introduced due to measure¬ 
ment by the advisory in the computational basis. If the advisory performs the 
measurement in other basis, then the secret may not be recovered. In this section 
we first analyse what happens when the adversary measures in arbitrary basis and 
then discuss how our secret sharing protocol can be modified to tolerate measure¬ 
ment in any basis. 


4.1 Analysis of Measurement in Arbitrary Basis 

Let Bob (without loss of generality) measure in 
a|0) + 6|1) and = b* |0) — a* 11), with a, b € 

can write |0) = a* |y) + b and |1) = b* |y) — a 
Thus, we can rewrite Equation © as 

life) = \ [a (|000> - |110> + |011) - |101» + 0 (|100> - |010) - |001) + |111»] 

- \ [« (|0> (a* |7> + b Jr 1 )) |0) - |1) ( b * | 7 ) - a |t^)) |0) 

+ |0> (b* |t) - a It- 1 )) |i) - |i) (a* |t) + & (t" 1 )) |i>) 

+/3 (ji) (a* |t) + b Jr 1 ))^ -10) (&* |t) - a It -1 )) |0) 

- 10) (a* |t) + b It - 1 )) |1) + |i) (&* It) - a [t" 1 )) |i>)] ■ 

When Bob measures this state in (|t) , It" 1 ")} basis, it can be easily seen that 
she gets each of |t) and Jt - 1 -) with probability 1. 

Suppose Bob observes |t). The remaining state becomes 

|^ C ) = -)= [a (a* 100) - b* 110) + b* |01) - a* |11)) 

+ 0 {a* |10) - b* |00) - a* |01) + b* |11»] . 


(It) ip" 1 ")} basis, where |t) = 
C and |a| 2 + |6| 2 = 1. Then we 
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After each applies Hadamard, the joint state becomes 

ipf ByC ^ ^ [(cm* - 0b* - ab* + f3a*)(a + b) |001) 

+(aa* - 0b* + ab* - 0a*)(a + b ) |100) 

+(aa* — 0b* + ab* — 0a*)(a — b ) 1110) 

+ (aa* — 0b* — ab* + 0a*){a — b) |011)] . 

Now, Bob and Charlie give their qubits to Alice. Alice applies CONTs considering 
her qubit as control. Then the overall state becomes 

tpf B ' yC ^ = ^ [(cm* - 0b* - ab* + 0a*)(a T b) |001) 

+(aa* - 0b* + ab* - 0a*)(a + b) |111) 

+(cm* — 0b* + ab* — 0a*)(a — b) 1101) 

+ ( aa * — 0b* — ab* + 0a*)(a — b) |011)] . 

Next, Alice operates Toffoli considering Bob and Charlie’s qubits as control. 
Then we get 

ipt B ' yC '^ = ^ [(cm* - 0b* - ab* + 0a*)(a + b) |001) 

+(aa* - 0b* + ab* - 0a*)(a + b) |011) 

+(aa* — 0b* + ab* — 0a*)(a — b) 1101) 

+ (aa* — 0b* — ab* + 0a*)(a — b) 1111)] . 

Now, Alice applies Hadamard on the first qubit. Thus, the resultant state becomes 
^AB 7 C^ = _L _ /J( a 6* _|_ a *fc)) |0) + ( a(ab* + a*b ) - 0) |1>) |11) 

+ ((«(M 2 ^ \b\ 2 ) + 0(a*b - ab*)^j |0) 

- (a(ab* - a*b) + 0(\b\ 2 - |a| 2 )) |1)) |01)j . 

After Alice applies the last phase gate, the state becomes 

^AB 7 C^ = _1_ [((cr - 0(ab* + a*b)) |0) - ( a(ab* + a*b) - 0) |1}) |11) 

+ ((«(|o| 2 - \b\ 2 ) + 0(a*b - ab*)^j |0) 

+ (a(ab* - a*b) + 0(\b \ 2 - |<z| 2 )) |1>) |01)j . (6) 

Note that due to the measurement, a is shifted to a' = a - 0(ab* + a*b) and 0 
is shifted to 0' = 0 — a(ab* + a*b). Thus, depending on the values of a and b, the 
secret evolves. 

Similar analysis holds for the case when Bob measures Continuing with 

the analysis of Bob’s measurement as ly), we find that when Alice measures the 
qubits corresponding to Bob and Charlie in (|00), |01), 110), 111)} basis, she gets 
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111} with probability | and |01) with probability 4. Note that if one takes a = 
1,6 = 0, then Equation d6j) coincides with Equation l|2|). On the other hand, if one 
takes a = 0,6 = 1, then Equation © coincides with Equation ©. 

Next, let us consider the case a = 6 = -4=, i.e., the measurement basis is 

v 2 

(1+) > |—)}■ In this case, when Bob measures |+), Equation © reduced to 

\^t B+C ) = - P) (|0> - I 1 )) I 11 ) • 

Upon measuring her ancilla bits in the computational basis, Alice would get wrong 
information that there is no eavesdropping. Moreover, the state is also not recov¬ 
ered properly at Alice’s end. Similar cases can be analysed considering Charlie or 
both. 

Thus, if the participants go for a measurement in arbitrary basis, then it is 
not possible to reconstruct the secret with simple quantum error correcting codes. 
However, with codes that can correct any kind of error, it is possible to design 
quantum secret sharing schemes that are more resilient. Below we outline this 
extension. 


4.2 Possible Resiliency against Arbitrary Operations by Cheaters 

In this section, we discuss remedies against not only arbitrary measurements but 
also arbitrary interactions by the Cheaters. The protocol described in Section [2] 
uses three qubit phase flip repetition code. Here, we modify the protocol with nine 
qubit Shor code m- This code is a combination of three qubit phase flip and bit 
flip codes. The qubit is first encoded using the phase flip code, i.e., |0) is encoded 

as |T T T) and |1) is represented as |-). Next, each of these qubits are encoded 

using three qubit bit flip code, i.e., |+) is encoded as |000) + |lll))/\/2 and h> is 
encoded as |000) — |lll))/\/2. 

Suppose, before the interaction by the adversary, the state of the system is 
\ti>ABc)- Any error T, including the one due to interaction, can be analyzed by 
expanding it in an operator-sum representation with operation elements {Ej}, we 
would have the post-interaction state as 

T \tpABc) (VbtBcl = y, A, \lpABc) (VABcl E \ ■ 

i 

As an operator, E j can be expanded as a linear combination of the identity, the bit 
flip X, the phase flip Z and the combined bit and phase flip XZ. Measuring the er¬ 
ror syndrome would collapse this superposition into one of the four states, namely, 

I TpABc), x Wabc), z I TpABc) and XZ IV>ABC>- By applying the appropriate inverse 
operation, the recovery is possible. 


5 Conclusion 

In this paper, we show how quantum error correcting codes can be suitably used to 
present quantum secret sharing schemes with certain kind of resiliency. Our work 
is not in the line of mostly studied quantum secret sharing that lends the idea 
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from teleportation. We explain the basic idea with a simple code and point out its 
merits and demerits. We also outline how any arbitrary adversarial attempt can 
be resisted with more complicated quantum error correcting codes. Detailed study 
with different kinds of access structures and finding out suitable error correcting 
codes are important as future works in this direction. 
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